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Detailed Action 
Priority 

1 . Receipt is acknowledged of papers submitted under 35 U.S.C. 1 1 9(a)-(d), 
which papers have been placed of record in the file. 

Claim Rejections - 35 USC § 101 

2. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requirements of this title. 

Claims 38, and 39 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. Claims 38 and 39 lack the 
proper preamble for a computer readable medium claim. This subject matter is 
not limited to that which falls within a statutory category of invention because it is 
not limited to a process, machine, manufacture, or a composition of matter. 
Correction is required. An example of an acceptable preamble for a computer 
type claims is "A computer readable medium encoded with a computer 
executable instructions, the instructions comprising". For further information on 
statutory computer type claims, see MPEP section 2100. 
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Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in 
public use or on sale in this country, more than one year prior to the date of application for patent in 
the United States. 

4. Claims 1, 2, 3-5, 11, 12, 15-22, 28, 34-37, 40-44, 49-51, 54-61, 67, 70-75 
are rejected under 35 U.S.C. 102(b) as being anticipated by An (Pub No.: 
2001/0040919). 

In claim 1, An disclosed the method of receiving a first traffic waveform 
representing a time distribution of data volume in a first direction in the data 
communication system in a first period of time; producing a correlation value 
representing a correlation of the first traffic waveform with a reference waveform 
(An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, 
lines 1-10, and paragraph 0024, lines 1-20). As shown in the reference, a bit 
stream data is received at 121, and through 122, and 123. The unit 124 received 
a sample value from 122, and a filter value from 123. Then, unit 124 takes the 
difference between both values. Therefore, we can interpret that the bit stream 
data is the first traffic waveform representing a time distribution of data volume. 
The correlation value is obtained when the unit 124 takes the difference between 
the sample and filter values; producing a bandwidth anomaly signal when the 
correlation value satisfies a criterion (An see paragraph 0025, lines 1-8, and 
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paragraph 0026, lines 1-15). As shown, the unit 125 compares the value 
outputted from 124 with a reference error level. If the data from unit 124 is 
smaller than the reference error level, then the unit 125 will output the 
comparison result signal to unit 126. 

Regarding to claim 2, An also disclosed the method of wherein producing 
the bandwidth anomaly signal comprises producing the denial of service attack 
signal when the correlation value is less than a reference value (An see 
paragraph 0025, lines 1-8, and paragraph 0026, lines 1-15). As shown, the unit 
125 compares the value outputted from 124 with a reference error level. If the 
data from unit 124 is smaller than the reference error level, then the unit 125 will 
output the comparison result signal to unit 126. The comparison result signal can 
be interpreted as the DDOS signal. 

Regarding to claim 3, An also disclosed the method of wherein producing 
the bandwidth anomaly signal comprises determining whether the correlation 
value is less than the reference value (An see paragraph 0025, lines 1-8, and 
paragraph 0026, lines 1-15). As shown, the unit 125 compares the value 
outputted from 124 with a reference error level. If the data from unit 124 is 
smaller than the reference error level, then the unit 125 will output the 
comparison result signal to unit 126. 

Regarding to claim 4, An also disclosed the method of receiving a second 
traffic waveform representing a time distribution of data volume in a second 
direction on the data communication system in a second period of time, and 
using the second traffic waveform as the reference waveform to produce the 
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correlation value (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20, and fig. 1, unit 120). 
As shown in unit 120, a unit 126 receives the filter value from 123, and a first 
comparison value from 125. Therefore, we can interpret that the second 
waveform reference value is generated from 123. 

Regarding to claim 5, An also disclosed the method of generating the first 
traffic waveform in response to a first set of traffic measurement values (An see 
fig. 1, unit 120, and see paragraph 0023, lines 1-8, and paragraph 0024, lines 1- 
20). As shown in the reference, a bit stream data is received at 121, and through 
122, and 123. The unit 124 received a sample value from 122, and a filter value 
from 123. Then, unit 124 takes the difference between both values, and output a 
result signal. Therefore, we can interpret that the result signal (first waveform) is 
generated based on sample and filtered values. 

Regarding to claim 1 1 , An also disclosed the method of the first traffic 
waveform represents a statistical measure of a time distribution of data volume in 
the first direction (An see fig. 1, unit 120, see fig. 2a, 2b, and see paragraph 
0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). 

Regarding to claim 12, An also disclosed the method of monitoring data in 
the first direction and producing the first set of traffic measurement values in 
response thereto (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20, and fig. 1, unit 120). 
As shown in unit 120, a unit 126 receives the filter value from 123, and a first 
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comparison value from 125. Therefore, we can interpret that the sampler is the 
monitoring data unit. 

Regarding to claim 15, An also disclosed the method of monitoring the 
data in the first direction comprises at least one of: counting packets and 
counting octets, in the first direction (An see paragraph 0021, lines 1-10). 

Regarding to claim 16, An also disclosed the method of causing a 
processor circuit operable to produce the first traffic waveform to communicate 
with at least one of a packet counter and an octet counter to receive values 
representing the first set of traffic measurement values (An see paragraph 0021 , 
lines 1-10). 

Regarding to claim 17, An also disclosed the method of causing the 
processor circuit to implement at least one of the packet counter and the octet 
counter (An see paragraph 0021, lines 1-10). 

Regarding to claim 18, An also disclosed the method of passively 
monitoring the data in the first direction (An see fig. 1 , unit 120, and see 
paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 0024, 
lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 126 receives the 
filter value from 123, and a first comparison value from 125. Therefore, we can 
interpret that the sampler is the monitoring data unit. 

Regarding to claim 19, An also disclosed the method of transmitting and 
receiving data from a data communication system, the data communication 
system method of claim 12 and further comprising signaling an operator in 
response to the bandwidth anomaly signal (An see paragraph 0025, lines 1-8, 
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paragraph 0026, lines 1-15, and see paragraph 0027, lines 1-15). As shown, the 
125 output a resulting signal to 126. The 126 is the operator. 

Regarding to claim 20, An also disclosed the method of transmitting and 
receiving data from a data communication system, the data communication 
system method of claim 12 and further comprising controlling at least one of 
transmission and reception of data from the data communication system in 
response to the bandwidth anomaly signal (An see paragraph 0025, lines 1-8, 
paragraph 0026, lines 1-15, and see paragraph 0029, lines 1-10). As shown, the 
125 output a resulting signal to 126. The 126 is the operator. As shown, the unit 
127 controls the transmission of data in response to the signal from 126 by 
performing comparing. 

Regarding to claim 21, An also disclosed the method of generating the 
first and second traffic waveforms in response to first and second sets of traffic 
measurement values, representing traffic in the first and second directions on the 
data communication system, respectively (An see fig. 1, unit 120, and see 
paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 0024, 
lines 1-20). As shown in the reference, a bit stream data is received at 121, and 
through 122, and 123. The unit 124 received a sample value from 122, and a 
filter value from 123. Then, unit 124 takes the difference between both values. 
First traffic is the sample value, and second traffic is the filter value. 

Regarding to claim 22, An also disclosed the method of receiving the first 
and second traffic waveforms comprises receiving first and second waveforms 
representing first and second statistical measures of first and second time 
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distributions respectively of data volume in first and second directions in the data 
communications system (An see fig. 1, unit 120, and see paragraph 0020, lines 
1-10, paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). As shown in 
the reference, a bit stream data is received at 121, and through 122, and 123. 
The unit 124 received a sample value from 122, and a filter value from 123. 
Then, unit 124 takes the difference between both values. 

Regarding to claim 28, An also disclosed the method of monitoring data in 
the first and second directions and producing the first and second sets of traffic 
measurement values respectively in response thereto (An see fig. 1, unit 120, 
and see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 
0024, lines 1-20). As shown in the reference, a bit stream data is received at 121, 
and through 122, and 123. The unit 124 received a sample value from 122, and a 
filter value from 123. Then, unit 124 takes the difference between both values. 
Therefore, unit 122 and 123 are both monitoring the data, and each forwards the 
data to different paths. The paths can be first and second direction. 

Regarding to claim 34, An also disclosed the method of passively 
monitoring the data in the first and second directions (An see fig. 1, unit 120, and 
see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 
0024, lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 126 receives 
the filter value from 123, and a first comparison value from 125. Therefore, we 
can interpret that the sampler is the monitoring data unit. 

Regarding to claim 35, An also disclosed the method of signaling an 
operator in response to the bandwidth anomaly signal (An see paragraph 0025, 
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lines 1-8, paragraph 0026, lines 1-15, and see paragraph 0027, lines 1-15). As 
shown, the 125 output a resulting signal to 126. The 126 is the operator. 

Regarding to claim 36, An also disclosed the method of controlling at least 
one of the transmission and reception of data from the data communication 
system in response to the bandwidth anomaly signal (An see paragraph 0025, 
lines 1-8, paragraph 0026, lines 1-15, and see paragraph 0029, lines 1-10). As 
shown, the 125 output a resulting signal to 126. The 126 is the operator. As 
shown, the unit 127 controls the transmission of data in response to the signal 
from 126 by performing comparing. 

Regarding to claim 37, An also disclosed the method of means for 
receiving a first traffic waveform representing a time distribution of data volume in 
a first direction in the data communication system in a first period of time; means 
for producing a correlation value representing a correlation of the first traffic 
waveform with a reference waveform (An see fig. 1, unit 120, and see paragraph 
0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). 
As shown in the reference, a bit stream data is received at 121, and through 122, 
and 123. The unit 124 received a sample value from 122, and a filter value from 
123. Then, unit 124 takes the difference between both values. Therefore, we can 
interpret that the bit stream data is the first traffic waveform representing a time 
distribution of data volume. The correlation value is obtained when the unit 124 
takes the difference between the sample and filter values; and means for 
producing a bandwidth anomaly signal when the correlation value satisfies a 
criterion (An see paragraph 0025, lines 1-8, and paragraph 0026, lines 1-15). As 
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shown, the unit 125 compares the value outputted from 124 with a reference 
error level. If the data from unit 124 is smaller than the reference error level, then 
the unit 125 will output the comparison result signal to unit 126. 

Regarding to claim 40, An also disclosed the method of receive a first 
traffic waveform representing a time distribution of data volume in a first direction 
in the data communication system in a first period of time; produce a correlation 
value representing a correlation of the first traffic waveform with a reference 
waveform (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). As shown in the 
reference, a bit stream data is received at 121, and through 122, and 123. The 
unit 124 received a sample value from 122, and a filter value from 123. Then, unit 
124 takes the difference between both values. Therefore, we can interpret that 
the bit stream data is the first traffic waveform representing a time distribution of 
data volume. The correlation value is obtained when the unit 124 takes the 
difference between the sample and filter values; and produce a bandwidth 
anomaly signal when the correlation value satisfies a criterion (An see paragraph 
0025, lines 1-8, and paragraph 0026, lines 1-15). As shown, the unit 125 
compares the value outputted from 124 with a reference error level. If the data 
from unit 124 is smaller than the reference error level, then the unit 125 will 
output the comparison result signal to unit 126. 

Regarding to claim 41, An also disclosed the method of the processor 
circuit is configured to produce the bandwidth anomaly signal when the 
correlation value is less than a reference value (An see paragraph 0025, lines 1- 
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8, and paragraph 0026, lines 1-15). As shown, the unit 125 compares the value 
outputted from 124 with a reference error level. If the data from unit 124 is 
smaller than the reference error level, then the unit 125 will output the 
comparison result signal to unit 126. The comparison result signal can be 
interpreted as the DDOS signal. 

Regarding to claim 42, An also disclosed the method of the processor 
circuit is configured to determine whether the correlation value is less than the 
reference value (An see paragraph 0025, lines 1-8, and paragraph 0026, lines 1- 
15). As shown, the unit 125 compares the value outputted from 124 with a 
reference error level. If the data from unit 124 is smaller than the reference error 
level, then the unit 125 will output the comparison result signal to unit 126. The 
comparison result signal can be interpreted as the DDOS signal. 

Regarding to claim 43, An also disclosed the method of the processor 
circuit is configured to receive a second traffic waveform representing a statistical 
measure of a time distribution of data volume in a second direction on the data 
communication system in a second period of time, and use the second traffic 
waveform as the reference waveform to produce the correlation value (An see 
fig. 1, unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, 
and paragraph 0024, lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 
126 receives the filter value from 123, and a first comparison value from 125. 
Therefore, we can interpret that the second waveform reference value generated 
from 123. 



Application/Control Number: 10/722,423 Page 
Art Unit: 2616 

Regarding to claim 44, An also disclosed the method of a first traffic 
waveform generator operable to receive a first set of traffic measurement values 
and to produce the first traffic waveform in response thereto (An see fig. 1 , unit 
120, and see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and 
paragraph 0024, lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 126 
receives the filter value from 123, and a first comparison value from 125. 
Therefore, we can interpret that the sampler is the monitoring data unit. 

Regarding to claim 49, An also disclosed the method of the processor 
circuit is configured to implement the first traffic waveform generator (An see fig. 
1, unit 120, and see paragraph 0023, lines 1-8, and paragraph 0024, lines 1-20). 
As shown in the reference, a bit stream data is received at 121, and through 122, 
and 123. The unit 124 received a sample value from 122, and a filter value from 
123. Then, unit 124 takes the difference between both values, and output a result 
signal. Therefore, we can interpret that the result signal (first waveform) is 
generated based on sample and filtered values. 

Regarding to claim 50, An also disclosed the method of the first traffic 
waveform represents a statistical measure of a time distribution of data volume in 
the first direction (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). As shown in the 
reference, a bit stream data is received at 121, and through 122, and 123. The 
unit 124 received a sample value from 122, and a filter value from 123. Then, unit 
124 takes the difference between both values. Therefore, we can interpret that 
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the bit stream data is the first traffic waveform representing a time distribution of 
data volume. 

Regarding to claim 51, An also disclosed the method of a communication 
interface operable to monitor data in the first direction and to produce the first set 
of traffic measurement values in response thereto (An see fig. 1, unit 120, and 
see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 
0024, lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 126 receives 
the filter value from 123, and a first comparison value from 125. Therefore, we 
can interpret that the sampler is the monitoring data interface. 

Regarding to claim 54, An also disclosed the method of the 
communication interface includes at least one of a packet counter and an octet 
counter operable to count a corresponding one of packets and octets of data in 
the first direction (An see paragraph 0021, lines 1-10). 

Regarding to claim 55, An also disclosed the method of the processor 
circuit is configured to communicate with the communication interface to receive 
values produced by at least one of a the packet counter and the octet counter, 
the values representing the first set of traffic measurement values (An see 
paragraph 0021, lines 1-10, and fig. 1 box 120). The unit 122 is the 
communication interface to receive values produce by the counter 121. 

Regarding to claim 56, An also disclosed the method of the processor 
circuit is configured to implement the communication interface (An see paragraph 
0021, lines 1-10, and fig. 1 box 120). The unit 122 is the communication interface 
to receive values produce by the counter 121 
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Regarding to claim 57, An also disclosed the method of a passive monitor 
operable to passively monitor the data in the first direction and to provide a copy 
of the data in the first direction to the communication interface (An see fig. 1 , unit 
120, and see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and 
paragraph 0024, lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 126 
receives the filter value from 123, and a first comparison value from 125. 
Therefore, we can interpret that the sampler is the monitoring data interface. 

Regarding to claim 58, An also disclosed the method of a signaling device 
for signaling an operator in response to the bandwidth anomaly signal (An see 
paragraph 0025, lines 1-8, paragraph 0026, lines 1-15, and see paragraph 0027, 
lines 1-15). As shown, the 125 output a resulting signal to 126. The 126 is the 
operator. 

Regarding to claim 59, An also disclosed the method of a communication 
control device for controlling at least one of the transmission and reception of 
data from the data communication system in response to the bandwidth anomaly 
signal (An see paragraph 0025, lines 1-8, paragraph 0026, lines 1-15, and see 
paragraph 0029, lines 1-10). As shown, the 125 output a resulting signal to 126. 
The 126 is the operator. As shown, the unit 127 controls the transmission of data 
in response to the signal from 126 by performing comparing. 

Regarding to claim 60, An also disclosed the method of a traffic waveform 
generator operable to receive the first and second sets of traffic measurement 
values and to produce the first and second traffic waveforms in response thereto 
(An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, 
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lines 1-10, and paragraph 0024, lines 1-20). As shown in the reference, a bit 
stream data is received at 121, and through 122, and 123. The unit 124 received 
a sample value from 122, and a filter value from 123. Then, unit 124 takes the 
difference between both values. First traffic is the sample value, and second 
traffic is the filter value. The first generator is the unit 122, and second generator 
is the unit 123. 

Regarding to claim 61, An also disclosed the method of the processor is 
configured to receive first and second traffic waveforms representing first and 
second statistical measures of first and second time distributions respectively of 
data volume in first and second directions in the data communications system 
(An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, 
lines 1-10, and paragraph 0024, lines 1-20). As shown in the reference, a bit 
stream data is received at 121, and through 122, and 123. The unit 124 received 
a sample value from 122, and a filter value from 123. Then, unit 124 takes the 
difference between both values. Sample value is the first traffic, and filter value is 
the second traffic. 

Regarding to claim 67, An also disclosed the method of a communication 
interface operable to monitor data in the first and second directions and to 
produce the first and second sets of traffic measurement values respectively in 
response thereto (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). As shown in the 
reference, a bit stream data is received at 121, and through 122, and 123. The 
unit 124 received a sample value from 122, and a filter value from 123. Then, unit 
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124 takes the difference between both values. Sample value is the first traffic, 
and filter value is the second traffic. 

Regarding to claim 70, An also disclosed the method of the 
communication interface includes at least one of a packet counter and an octet 
counter operable to count a corresponding one of packets and octets of data for 
each of the first and second directions (An see paragraph 0021, lines 1-10). 

Regarding to claim 71, An also disclosed the method of the processor 
circuit is configured to communicate with the communication interface to receive 
values produced by at least one of the packet counter and the octet counter, the 
values representing the first and second sets of traffic measurement values (An 
see paragraph 0021, lines 1-10). 

Regarding to claim 72, An also disclosed the method of the processor 
circuit is configured to implement the communication interface (An see paragraph 
0021, lines 1-10, and fig. 1 box 120). The unit 122 is the communication interface 
to receive values produce by the counter 121. 

Regarding to claim 73, An also disclosed the method of a passive monitor 
operable to passively monitor the data in the first and second directions and to 
provide copies of the data to the communication interface (An see fig. 1 , unit 120, 
and see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 
0024, lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 126 receives 
the filter value from 123, and a first comparison value from 125. Therefore, we 
can interpret that the sampler is the monitoring data unit. 
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Regarding to claim 74, An also disclosed the method of operable to 
transmit and receive data from a data communication system, the data 
communication apparatus comprising the apparatus of claim 40 and further 
comprising a signaling device for signaling an operator in response to the 
bandwidth anomaly signal (An see paragraph 0025, lines 1-8, paragraph 0026, 
lines 1-15, and see paragraph 0027, lines 1-15). As shown, the 125 output a 
resulting signal to 126. The 126 is the operator. 

Regarding to claim 75, An also disclosed the method of a communication 
control device for controlling at least one of the transmission and reception of 
data from the data communication system in response to the bandwidth anomaly 
signal (An see paragraph 0025, lines 1-8, paragraph 0026, lines 1-15, and see 
paragraph 0029, lines 1-10). As shown, the 125 output a resulting signal to 126. 
The 126 is the operator. As shown, the unit 127 controls the transmission of data 
in response to the signal from 126 by performing comparing. 



Claim Rejections - 35 USC § 103 

5. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 
148 USPQ 459 (1966), that are applied for establishing a background for 
determining obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at 
issue. 

3. Resolving the level of ordinary skill in the pertinent art. 
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4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

7. Claims 6, 8-10, 23, 25-27, 45, 47, 48,62, 64-66 are rejected under 35 
U.S.C. 103(a) as being unpatentable over An (Pub No.: 2001/0040919), in view 
of Gillberg et al. (Pat No.: 6393316). 

For claim 6, An disclosed all the subject matter of the claimed invention 
with the exception of generating the first traffic waveform comprises subjecting 
the first set of traffic measurement values to a Discrete Wavelet Transform. 
Gillberg from the same or similar fields of endeavor teaches the method of 
generating the first traffic waveform comprises subjecting the first set of traffic 
measurement values to a Discrete Wavelet Transform (Gillberg et al. see 
column 16, lines 15-40). Thus, it would have been obvious to the person of 
ordinary skill in the art at the time of the invention to use the method as taught by 
Gillberg et al. in the network of An. The motivation for using the method as taught 
by Gillberg et al. in the network of An being that as more accurate waveform can 
be constructed using 64 wavelet. 

Regarding to claim 8, Gillberg also teaches the method of generating the 
first traffic waveform comprises causing the Discrete Wavelet Transform to 
produce a first component, the first component representing the first traffic 
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waveform (Gillberg et al. see column16, lines 15-40). Thus, it would have been 
obvious to the person of ordinary skill in the art at the time of the invention to use 
the method as taught by Gillberg et al. in the network of An. The motivation for 
using the method as taught by Gillberg et al. in the network of An being that as 
more accurate waveform can be constructed using 64 wavelet. 

Regarding to claim 9, An also disclosed the method of producing the 
correlation value comprises correlating the first component with the reference 
waveform (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20, and fig. 1, unit 120). 
As shown in unit 120, a unit 126 receives the filter value from 123, and a first 
comparison value from 125. Therefore, we can interpret that the sample value is 
the first component. 

Regarding to claim 10, An also disclosed the method of using a processor 
circuit to generate the first traffic waveform and to correlate the first traffic 
waveform with the reference waveform (An see fig. 1 , unit 120, and see 
paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 0024, 
lines 1-20). As shown in the reference, a bit stream data is received at 121, and 
through 122, and 123. The unit 124 received a sample value from 122, and a 
filter value from 123. Then, unit 124 takes the difference between both values. 
Therefore, we can interpret that the bit stream data is the first traffic waveform 
representing a time distribution of data volume. The correlation value is obtained 
when the unit 124 takes the difference between the sample and filter values. 
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Regarding to claim 23, Gillberg also teaches the method of generating the 
first and second traffic waveforms comprises subjecting the first and second sets 
of traffic measurement values respectively, to a Discrete Wavelet Transform 
(Gillberg et al. see column 16, lines 15-40). 

Regarding to claim 25, Gillberg also teaches the method of causing the 
Discrete Wavelet Transform to produce a first component, representing the first 
traffic waveform and a second component representing the second traffic 
waveform (Gillberg et al. see column16, lines 15-40). 

Regarding to claim 26, An also disclosed the method of producing the 
correlation value comprises correlating the first and second components (An see 
fig. 1, unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, 
and paragraph 0024, lines 1-20). As shown in the reference, a bit stream data is 
received at 121, and through 122, and 123. The unit 124 received a sample 
value from 122, and a filter value from 123. Then, unit 124 takes the difference 
between both values. Therefore, we can interpret that the sample value is the 
first component, and the filtered valued is the second component. 

Regarding to claim 27, An also disclosed the method of comprising 
implementing a traffic waveform generator in a processor circuit used to produce 
the correlation value (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). As shown in the 
reference, a bit stream data is received at 121, and through 122, and 123. The 
unit 124 received a sample value from 122, and a filter value from 123. Then, unit 
124 takes the difference between both values. Therefore, we can interpret that 
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the bit stream data is the first traffic waveform representing a time distribution of 
data volume. The correlation value is obtained when the unit 124 takes the 
difference between the sample and filter values. 

Regarding to claim 45, Gillberg et al. also disclosed the method of the first 
traffic waveform generator is configured to produce the first traffic waveform by 
subjecting the first set of traffic measurement values to a Discrete Wavelet 
Transform (Gillberg et al. see column16, lines 15-40). 

Regarding to claim 47, Gillberg et al. also disclosed the method of the first 
traffic waveform generator is configured to cause the Discrete Wavelet Transform 
to produce a first component, the first component representing the first traffic 
waveform (Gillberg et al. see column16, lines 15-40). 

Regarding to claim 48, An also disclosed the method of the processor 
circuit is configured to produce the correlation value by correlating the first 
component with the reference waveform (An see fig. 1, unit 120, and see 
paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and paragraph 0024, 
lines 1-20, and fig. 1, unit 120). As shown in unit 120, a unit 126 receives the 
filter value from 123, and a first comparison value from 125. Therefore, we can 
interpret that the sample value is the first component. 

Regarding to claim 62, Gillberg et al. also disclosed the method of the 
traffic waveform generator is configured to produce the first and second traffic 
waveforms by subjecting the first and second sets of traffic measurement values 
respectively, to a Discrete Wavelet Transform (Gillberg et al. see column16, lines 
15-40). 
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Regarding to claim 64, Gillberg et al. also disclosed the method of the 
traffic waveform generator is configured to cause the Discrete Wavelet Transform 
to produce a first component, representing the first traffic waveform and a second 
component representing the second traffic waveform (Gillberg et al. see 
column16, lines 15-40). 

Regarding to claim 65, An also disclosed the method of the processor 
circuit is configured to produce the correlation value by correlating the first and 
second components (An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, 
paragraph 0021, lines 1-10, and paragraph 0024, lines 1-20). As shown in the 
reference, a bit stream data is received at 121, and through 122, and 123. The 
unit 124 received a sample value from 122, and a filter value from 123. Then, unit 
124 takes the difference between both values. Therefore, we can interpret that 
the sample value is the first component, and the filtered valued is the second 
component. 

Regarding to claim 66, An also disclosed the method of the processor 
circuit is configured to implement the traffic waveform generator (An see fig. 1 , 
unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, lines 1-10, and 
paragraph 0024, lines 1-20). As shown in the reference, a bit stream data is 
received at 121, and through 122, and 123. The unit 124 received a sample 
value from 122, and a filter value from 123. Then, unit 124 takes the difference 
between both values. Therefore, we can interpret that the sample value is the 
generator. 
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8. Claims 7, 24, 46, and 63 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over An (Pub No.: 2001/0040919), in view of Gillberg et al. (Pat 
No.: 6393316), as applied to claim 6 above, and further in view of Sahinoglu et 
al. (Pub No. : 2003/0021 295). 

For claim 7, An and Gillberg et al. disclosed all the subject matter of the 
claimed invention with the exception of subjecting the first set of traffic 
measurement values to the Discrete Wavelet Transform comprises using Haar 
wavelet filter coefficients in the Discrete Wavelet Transform. Sahinoglu et al. from 
the same or similar fields of endeavor teaches the method of subjecting the first 
set of traffic measurement values to the Discrete Wavelet Transform comprises 
using Haar wavelet filter coefficients in the Discrete Wavelet Transform 
(Sahinoglu et al. see paragraph 0035, lines 1-6). Thus, it would have been 
obvious to the person of ordinary skill in the art at the time of the invention to use 
the method as taught by Sahinoglu et al. in the network of An and Gillberg et al. 
The motivation for using the method as taught by Sahinoglu et al. in the network 
of An and Gillberg et al. being that it allocates the communication bandwidth 
based on the short and long term fluctuations in the incoming traffic patter. 

Regarding to claim 24, Sahinoglu et al. also teaches the method of 
subjecting the first and second sets of traffic measurement values to the Discrete 
Wavelet Transform comprises using Haar wavelet filter coefficients in the 
Discrete Wavelet Transform (Sahinoglu et al. see paragraph 0035, lines 1-6). 
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Regarding to claim 46, Sahinoglu et al. also teaches the method of the 
first traffic waveform generator is configured to use Haar wavelet filter 
coefficients in the Discrete Wavelet Transform (Sahinoglu et al. see paragraph 
0035, lines 1-6). 

Regarding to claim 63, Sahinoglu et al. also teaches the method of the 
traffic waveform generator is configured to use Haar wavelet filter coefficients in 
the Discrete Wavelet Transform (Sahinoglu et al. see paragraph 0035, lines 1-6). 

9. Claims 13,14, 29, 30, 52, 53, 68, 69 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over An (Pub No.: 2001/0040919), in view of Eglin (Pub 
No.: 2004/0047320). 

For claim 13, An disclosed all the subject matter of the claimed invention 
with the exception of producing the first set of traffic measurement values 
comprises producing values representing a property of an Ethernet statistics 
group in a remote monitoring protocol. Eglin from the same or similar fields of 
endeavor teaches the method of producing the first set of traffic measurement 
values comprises producing values representing a property of an Ethernet 
statistics group in a remote monitoring protocol (Eglin see paragraph 0005, lines 
1-4, and see paragraph 0039, lines 1-10). The wireless protocol designated 
802.1 1b can be the remote monitoring protocol using Ethernet interfaces, which 
can be Ethernet statistics group. Thus, it would have been obvious to the person 
of ordinary skill in the art at the time of the invention to use the method as taught 
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by Eglin in the network of An. The motivation for using the method as taught by 
Eglin in the network of An being that Ethernet is low risk and low cost component 
but still perform very high speed transmission in the network. 

Regarding to claim 14, Eglin also teaches the method of causing a 
processor circuit operable to produce the first traffic waveform to communicate 
with a communication interface to receive the values representing the property of 
an Ethernet statistics group (Eglin see paragraph 0005, lines 1-4, and see 
paragraph 0039, lines 1-10). The wireless protocol designated 802.11b can be 
the remote monitoring protocol using Ethernet interfaces, which can be Ethernet 
statistics group. 

Regarding to claim 29, Eglin also teaches the method of producing the 
first and second sets of traffic measurement values comprises producing values 
representing a property of an Ethernet statistics group in a remote monitoring 
protocol, for each of the first and second directions (Eglin see paragraph 0005, 
lines 1-4, and see paragraph 0039, lines 1-10). The wireless protocol designated 
802.1 1b can be the remote monitoring protocol using Ethernet interfaces, which 
can be Ethernet statistics group. 

Regarding to claim 30, Eglin also teaches the method of causing a 
processor circuit operable to produce the first and second traffic waveforms to 
communicate with a communication interface to receive the values representing 
a property of an Ethernet statistics group (Eglin see paragraph 0005, lines 1-4, 
and see paragraph 0039, lines 1-10). The wireless protocol designated 802.11b 
can be the remote monitoring protocol. 
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Regarding to claim 52, Eglin also teaches the method of the 
communication interface produces values representing a property of an Ethernet 
statistics group in a remote monitoring protocol (Eglin see paragraph 0005, lines 
1-4, and see paragraph 0039, lines 1-10). The wireless protocol designated 
802.11b can be the remote monitoring protocol. 

Regarding to claim 53, Eglin also teaches the method of the processor 
circuit is configured to communicate with the communication interface to receive 
the values representing a property of an Ethernet statistics group, the values 
representing the first set of traffic measurement values (Eglin see paragraph 
0005, lines 1-4, and see paragraph 0039, lines 1-10). The wireless protocol 
designated 802.1 1b can be the remote monitoring protocol. 

Regarding to claim 68, Eglin also teaches the method of the 
communication interface produces values representing a property of an Ethernet 
statistics group in a remote monitoring protocol, for each of the first and second 
directions (Eglin see paragraph 0005, lines 1-4, and see paragraph 0039, lines 1- 
10). The wireless protocol designated 802.1 1b can be the remote monitoring 
protocol. 

Regarding to claim 69, Eglin also teaches the method of the processor 
circuit is configured to communicate with the communication interface to receive 
the values representing a property of an Ethernet statistics group, for each of the 
first and second directions, the values representing the first and second sets of 
traffic measurement values respectively (Eglin see paragraph 0005, lines 1-4, 
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and see paragraph 0039, lines 1-10). The wireless protocol designated 802.11b 
can be the remote monitoring protocol. 



10. Claims 31-33, 38, and 39 are rejected under 35 U.S.C. 102(b) as 
anticipated by or, in the alternative, under 35 U.S.C. 103(a) as obvious over An 
(Pub No.: 2001/0040919). 

For claim 31, An disclosed the method of monitoring the data comprises at 
least one of: packet counters and octet counters in each of the first and second 
directions (An see paragraph 0021, lines 1-10). Although the reference did not 
teach counter in first and second directions, however an official notice is taken; 
counting data in forward and reverse directions is obvious to the person of 
ordinary skill in the art. Thus, it would have been obvious to the person of 
ordinary skill in the art at the time of the invention to use the method of 
obviousness in the network of An. The motivation for using the method of 
obviousness in the network of An being that it provides double counting method 
which greatly improves the accuracy of the transmission. 

Regarding to claim 32, An also disclosed the method of causing a 
processor circuit operable to produce the first and second traffic waveforms to 
communicate with at least one of a packet counter and an octet counter to 
receive values representing the first and second sets of traffic measurement 
values (An see paragraph 0021, lines 1-10). Although the reference did not teach 
the second waveform communicating with the counter, however its obvious to the 



Application/Control Number: 10/722,423 Page 28 

Art Unit: 2616 

person of ordinary skill in the art the produce the second waveform and to 
communicate with the counter. 

Regarding to claim 33, An also disclosed the method of causing the 
processor circuit to implement at least one of the packet counter and the octet 
counter (An see paragraph 0021, lines 1-10). 

Regarding to claim 38, An also disclosed the method of computer 
readable medium encoded with codes for directing a processor circuit to detect 
bandwidth anomalies in a data communication system, by receiving a first traffic 
waveform representing a time distribution of data volume in a first direction in the 
data communication system in a first period of time; producing a correlation value 
representing a correlation of the first traffic waveform with a reference waveform 
(An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, 
lines 1-10, and paragraph 0024, lines 1-20). As shown in the reference, a bit 
stream data is received at 121, and through 122, and 123. The unit 124 received 
a sample value from 122, and a filter value from 123. Then, unit 124 takes the 
difference between both values. Therefore, we can interpret that the bit stream 
data is the first traffic waveform representing a time distribution of data volume. 
The correlation value is obtained when the unit 124 takes the difference between 
the sample and filter values; and producing a bandwidth anomaly signal when 
the correlation value satisfies a criterion (An see paragraph 0025, lines 1-8, and 
paragraph 0026, lines 1-15). As shown, the unit 125 compares the value 
outputted from 124 with a reference error level. If the data from unit 124 is 
smaller than the reference error level, then the unit 125 will output the 
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comparison result signal to unit 126. Although the reference did not disclose the 
method of computer readable medium code, however it obvious to the person of 
ordinary skill in the art to produce a code to perform such task. 

Regarding to claim 39, An also disclosed the method of computer 
readable signal encoded with codes for directing a processor circuit to detect 
bandwidth anomalies in a data communication system, by receiving a first traffic 
waveform representing a time distribution of data volume in a first direction in the 
data communication system in a first period of time; producing a correlation value 
representing a correlation of the first traffic waveform with a reference waveform 
(An see fig. 1, unit 120, and see paragraph 0020, lines 1-10, paragraph 0021, 
lines 1-10, and paragraph 0024, lines 1-20). As shown in the reference, a bit 
stream data is received at 121, and through 122, and 123. The unit 124 received 
a sample value from 122, and a filter value from 123. Then, unit 124 takes the 
difference between both values. Therefore, we can interpret that the bit stream 
data is the first traffic waveform representing a time distribution of data volume. 
The correlation value is obtained when the unit 124 takes the difference between 
the sample and filter values; and producing a bandwidth anomaly signal when 
the correlation value satisfies a criterion (An see paragraph 0025, lines 1-8, and 
paragraph 0026, lines 1-15). As shown, the unit 125 compares the value 
outputted from 124 with a reference error level. If the data from unit 124 is 
smaller than the reference error level, then the unit 125 will output the 
comparison result signal to unit 126. Although the reference did not disclose the 
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method of computer readable medium code, however it obvious to the person of 
ordinary skill in the art to produce a code to perform such task. 



Conclusion 

1 1 . The prior art made of record and not relied upon is considered pertinent to 
the applicant's disclosure. Downey et al. (Pat No.: 5553081), and Zalitzky et al. 
(Pub No.: 2004/0037317) are show systems which considered pertinent to the 
claimed invention. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Kan Yuen whose telephone number is 571- 
270-2413. The examiner can normally be reached on Monday-Friday 1 0:00a. m- 
3:00p.m EST. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Ricky O. Ngo can be reached on 571-272-3139. The fax 
phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786- 
9199 (IN USA OR CANADA) or 571-272-1000. 




RICKY Q. NGO 
SUPERVISORY PATENT EXAMINER 



